Port checker

How this tool works

Enter a hostname or IP address and a port number between 1 and 65535, and our web server tries to open a TCP connection to it. The tool is free, needs no sign-up and is rate-limited per visitor so it cannot be used to sweep a host.

A TCP connection starts with a three-step handshake. Our server sends a SYN packet to the port. A program listening there replies with SYN-ACK and the connection is established, which the tool reports as open. If no program is listening, the host's operating system replies with a reset and the tool reports closed. If nothing comes back before the timeout, the tool reports the port as filtered: a firewall, a router without a forwarding rule, or a network that drops the packet is in the way. As soon as the result is known the connection is closed again; the tool never sends application data to the service.

Hostnames are resolved on our server before connecting. If the name has several addresses, the first one is used. Private and reserved addresses such as 192.168.1.1 cannot be tested because they are not reachable from the internet; the port checker is a view from outside, which is the whole point.

Each check is a single connection attempt from one location. For a quick look at many common ports at once, use the port scanner, which runs from our dedicated probe server.

How to read the result

Open. The handshake completed. A program on the target accepted the connection, and the port is reachable from the public internet. For a service you host on purpose, this is the goal. For a port you did not expect, find out what is listening.

Closed. The host is reachable and answered, but nothing is listening on that port. The path through the ISP and router works; the problem, if any, is on the machine itself: the service is not running, is bound to a different port, or is listening only on localhost.

Filtered or timed out. No answer at all. This is the most common result for a home connection and usually means the router has no forwarding rule for that port, or a firewall drops unsolicited traffic, or the ISP blocks the port. It can also mean the host is offline or the address is wrong; check with the ping tool whether the host answers at all.

A result applies to the moment of the check and to the path from our server. A port can be open from one network and filtered from another when a firewall allows specific sources, and a host that sleeps or changes address will give different answers over time.

How to fix a port that should be open

Work from the outside in. Each step corresponds to one thing that can drop the connection.

Step 1: confirm the address

1. Look up your current public address on the IP lookup page. Home connections change address; the one you forwarded last month may not be the one you have today.
2. If the address shown is in the 100.64.0.0 to 100.127.255.255 range, or your router's WAN address differs from your public address, your ISP uses carrier-grade NAT. Incoming connections cannot reach you at all until the ISP gives you a public address, which usually means asking for a static or non-NAT option. No router setting fixes this.

Step 2: forward the port on the router

1. Give the target machine a fixed local address, either through a static DHCP lease on the router or a static address on the machine.
2. In the router's admin page, find the section called port forwarding, virtual server, NAT or applications. Create a rule: external port, internal port (usually the same), protocol TCP, and the machine's local address.
3. Save, and on some routers reboot. If you run two routers in a chain, for example an ISP box in front of your own, the rule is needed on both, or the first must be set to bridge mode.
4. Re-run the check. If the result changed from filtered to closed, the router is now forwarding and the remaining problem is on the machine.

Step 3: open the firewall on the machine

1. Windows. Open Windows Defender Firewall with Advanced Security, add an inbound rule for the port (TCP), allow the connection, and apply it to the network profile you use. If the connection is marked public, either switch it to private or apply the rule to the public profile.
2. macOS. The built-in firewall allows connections per application rather than per port. In System Settings, Network, Firewall, make sure the application is allowed, or turn off "Block all incoming connections".
3. Linux with ufw. Run sudo ufw allow 8080/tcp and sudo ufw status to confirm. With firewalld: sudo firewall-cmd --add-port=8080/tcp --permanent followed by sudo firewall-cmd --reload. On a server without either, check iptables -L -n or nft list ruleset for a rule dropping the port.
4. Cloud servers. The provider's security group or network firewall sits in front of the machine's own firewall. Add an inbound rule for the port there, with the source set to the addresses that should reach it. Both layers must allow the port.

Step 4: make sure the service is actually listening

1. On the machine, list listening sockets: netstat -an | findstr LISTENING on Windows, sudo ss -ltnp on Linux, sudo lsof -iTCP -sTCP:LISTEN -n -P on macOS.
2. A line showing 127.0.0.1:8080 means the service accepts local connections only. Change its bind address to 0.0.0.0 (or the machine's address) in the service's configuration.
3. A line showing 0.0.0.0:8080 or :::8080 means it is listening on all interfaces; if the check still says closed, the firewall is the remaining suspect.
4. Re-run the check. Open means the whole chain works.

Step 5: ports the ISP blocks

Consumer ISPs commonly block inbound port 25 (SMTP) and often 135 to 139 and 445 (Windows file sharing), sometimes 80 and 443 on residential plans. If a port stays filtered after every step above, move the service to a different port and forward that instead, or check the ISP's published policy.

Common ports and what they belong to

For a check of all the common ports at once, see the port scanner page.

Checking ports from your own computer

To test from inside your network rather than from the internet, use a local client. Test-NetConnection 192.168.1.20 -Port 8080 in PowerShell reports whether the TCP connection succeeded. On macOS and Linux, nc -zv 192.168.1.20 8080 does the same, and curl -v http://192.168.1.20:8080/ adds a request so you can see the service respond. If the port is open locally and filtered from here, the problem is in the router or the ISP; if it is closed locally too, it is on the machine.

Port forwarding works from outside but not from inside

A frequent puzzle: the check on this page says a port is open, a friend can connect, but you cannot reach your own server by its public address from inside your network. This is not a forwarding problem. Many consumer routers do not support NAT loopback, also called hairpin NAT, which is what lets a device on the LAN connect to the router's public address and be forwarded back in. Use the server's local address from inside the network, or add a hosts-file entry on your computer that maps the hostname to the local address, and keep the public address for people outside.

The opposite case also happens: the service works from inside and the check here says filtered. That is the normal sign of a missing forwarding rule or a firewall, and the step-by-step section above applies.

Game servers, remote access and self-hosted apps

Hosting a game server at home is the most common reason people check a port. The pattern is the same for every game: the server listens on a port, the router must forward that port, and friends connect to your public address. Check the game's documentation for the port and protocol; many games use TCP for the connection and UDP for the gameplay traffic, and only the TCP side can be confirmed here. A result of open for the TCP port with players still unable to join means the UDP port is not forwarded.

For remote desktop, SSH and self-hosted applications, an open result is only the first half of the job. Anything reachable from the internet is probed constantly by automated scanners within minutes of appearing. Use key-based authentication for SSH, do not expose remote desktop directly, and put administration panels behind a VPN or a reverse proxy with authentication. A port that is open for your convenience is open for everyone else too.

Checking a VPS or cloud server

On a rented server there is no home router, so the chain is shorter: the provider's network firewall or security group, then the server's own firewall, then the service. New servers often come with a default security group that allows only SSH, which is why a freshly installed web server shows port 80 as filtered until a rule is added. After adding the rule, run the check again; closed means the provider now lets traffic through and the web server is not listening yet, open means the site is reachable.

If the server has both an IPv4 and an IPv6 address, remember that this check tests the IPv4 side only. Firewall rules for IPv6 are separate on most systems, and a service that is open over IPv4 can be closed over IPv6 or the reverse.

Why some ports are open that you never configured

A result of open on a port you did not set up usually has an ordinary explanation. Routers expose their own management interface, sometimes on the WAN side, on ports such as 80, 443 or 8080. Universal Plug and Play lets applications and devices on the LAN open ports automatically, and game consoles, media servers and some cameras do exactly that. A server image may ship with a database, a mail daemon or a monitoring agent listening on all interfaces. Identify the process with the listening-socket commands above, decide whether it needs to be reachable, and either bind it to localhost, block it in the firewall or disable it. The port scanner is the quickest way to find all such ports at once.

Limits of this tool

• The check is a TCP connection only. UDP services cannot be tested this way, and a UDP port will always look filtered.
• The connection comes from one place, our web server. A firewall that allows only certain source addresses, or a geographic block, will show filtered here while the port is open for the sources it allows.
• Our server connects over IPv4. An IPv6-only host or an AAAA-only hostname cannot be tested from this page.
• Only one port per check, and checks are rate-limited. For a broader view, use the port scanner.
• Open means something accepted the TCP handshake. It does not verify what the service is, whether it works, or whether it is secure.
• Hostnames with several addresses are tested against the first one returned by our resolver.
• A result is a snapshot. Dynamic addresses, sleeping devices and intermittent connectivity change the answer from minute to minute.
• Private, loopback and reserved addresses are refused because they cannot be reached from the internet.